Stateless MCP 2.0 simplifies agent tool integration with single-request protocol

The Model Context Protocol (MCP) specification was updated to version 2.0 on 2026-07-28, marking the most significant change to the protocol since its launch. The update introduces a stateless design that replaces the legacy stateful approach, which previously required two HTTP requests to initialize a session and call a tool.

The legacy stateful MCP required clients to first send an initialization request to obtain a session ID, then use that ID in a second request to invoke a tool. In contrast, the new stateless MCP consolidates both steps into a single HTTP request, embedding method and tool name directly in headers and simplifying payload structure.

Stateless MCP reduces implementation complexity for both clients and servers. Developers no longer need to maintain server-side session state or route requests to specific backend machines, which improves scalability for web applications. The protocol’s simplicity also makes it more accessible for smaller models running on local hardware to drive MCP tools effectively.

Simon Willison released three open-source projects this week to demonstrate and leverage the new stateless MCP specification. The first, mcp-explorer, is a stateless Python CLI tool for interactively probing MCP servers. It can be run without installation via uvx, allowing users to list available tools, inspect their schemas, and execute them directly against remote MCP endpoints.

Willison also released datasette-mcp, a Datasette plugin that adds a /-/mcp endpoint to any Datasette instance. The plugin exposes three tools: list_databases(), get_database_schema(database_name), and execute_sql(database_name, sql) (read-only). This enables agents and chat tools like ChatGPT or Claude to run SQL queries against hosted Datasette instances, as demonstrated on datasette.simonwillison.net/-/mcp.

The third project, llm-mcp-client, is an alpha plugin for the LLM tool that integrates MCP support. It allows users to invoke MCP endpoints directly from LLM’s command line interface, as shown in an example where the tool counted 151 notes by querying a Datasette-backed MCP server.

Willison argues that MCP is a safer foundation for building agent workflows compared to granting agents arbitrary shell or curl access. The protocol’s tool-based model makes it easier to audit capabilities and reason about potential security risks, such as prompt injection, compared to open-ended execution environments.